RUSTSEC-2026-0383

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0383

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0383.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0383

Aliases

Published

2026-10-19T12:00:00Z

Modified

2026-10-21T06:30:02Z

Summary

Bundled root certificates allow trust in distrusted emSign intermediates

Details

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known.

Version 1.0.10+ removes this root.

Version 0.26.11 is a compatibility wrapper that re-exports parent::TLS_SERVER_ROOT_CERTS from its webpki-root-certs 1.x dependency; it contains no separate root certificate list. Its resolved 1.x dependency must be updated to 1.0.10 or later.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / webpki-root-certs

Package

Name: webpki-root-certs; View open source insights on deps.dev
Purl: pkg:cargo/webpki-root-certs

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.26.11

Introduced

0.26.12-0

Fixed

1.0.10

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [],
        "os":  []
    }
}